Just-in-time permissions need IGA to enforce least privilege

At a glance

What this is: This analysis explains why JIT permissions reduce exposure but only enforce least privilege when IGA supplies the entitlement model, policy checks, and audit trail.

Why it matters: It matters because IAM teams need governance around who can request access, what they can receive, and how entitlement scope is reviewed across human, NHI, and agent-driven access.

Context

Just-in-time permissions are time-bound entitlements, not a complete governance model. They narrow how long access exists, but they do not decide whether the entitlement should exist, whether it conflicts with policy, or whether the identity estate is already over-granted.

The article frames the real problem as standing privilege, which accumulates across users, service accounts, workloads, and AI agents when access is granted once and never re-evaluated. In that model, least privilege fails less because access lasts too long and more because access was never governed well enough to begin with.

That makes this a governance story as much as an access-control story. JIT handles expiry, while IGA supplies the discovery, policy, contextual approval, and evidence needed to make the entitlement itself defensible.

Key questions

Q: When does just-in-time access fail to reduce privilege risk?

A: JIT fails when access is still broad, poorly logged, or not revoked after task completion. If approval does not narrow the scope of access and expiry is not enforced, the control only changes how access is granted, not how long it remains dangerous. In that case, standing privilege is still the real problem.

Q: Why does standing privilege still create so much identity risk?

A: Standing privilege keeps elevated access available long after the work that justified it has ended. That increases blast radius, weakens accountability, and makes review processes chase a moving target. Just-in-time access only helps when elevation is short-lived, context-aware, and paired with clean role design and reliable offboarding.

Q: What do teams get wrong about temporary access in user access reviews?

A: A common mistake is treating temporary access as low risk and then forgetting to revoke it when the task ends. That leaves short term permissions active far beyond their intended window. Teams should set expiration dates, track exceptions closely, and confirm removal as part of every review cycle.

Q: How should organisations govern JIT access for privileged machine identities?

A: Treat JIT as a control for task-scoped entitlement, not as a convenience feature. The access request should be tied to a specific use case, the privilege should expire automatically, and the identity should return to a non-privileged state after the job completes. That approach reduces standing access and makes privileged use easier to audit.

Technical breakdown

What JIT permissions actually control

Just-in-time permissions grant entitlements only for a limited business window and then remove them automatically. In the article’s framing, they operate at the level of roles, group membership, and application-specific rights, which means they shape what an identity can do inside a target system, not whether the identity may enter the session. That distinction matters because a short-lived privilege can still be too broad if the scope was wrong at issuance time. JIT is a timing control, not a governance decision engine.

Practical implication: Use JIT to shorten exposure windows, but do not treat expiry as proof that access was properly authorized.

Why standing privilege persists across identity estates

Standing privilege persists because access is commonly granted for a project, role, or operational need and then left in place after the need passes. The article highlights human users, service accounts, automation workloads, and AI agents as all contributing to that accumulation, with non-human identities especially hard to review because no joiner-mover-leaver event naturally forces a reassessment. The technical issue is not just excess access. It is the absence of a durable governance event that revisits entitlement validity before the permission becomes reusable attack surface.

Practical implication: Inventory the identities that retain access without an obvious lifecycle event and prioritise them for review and expiry control.

How IGA supplies the missing entitlement logic

IGA adds the decision layer JIT cannot provide on its own. It discovers entitlements across applications, evaluates eligibility against policy, applies contextual checks such as role, project, and resource sensitivity, and produces certification evidence for audit and remediation. In practical terms, IGA defines which permissions are legitimate candidates for JIT issuance and which combinations violate policy before the timer starts. That is why the article treats IGA as the mechanism that turns JIT from temporary access into enforced least privilege.

Practical implication: Anchor JIT to IGA policy and certification so that time-bound access is also entitlement-bound.

Threat narrative

Attacker objective: The attacker aims to turn valid credentials into outsized access by exploiting the permissions already attached to the account.

1. Entry begins when stolen credentials or an over-granted account provide a valid login, even if the access was originally meant to be temporary.
2. Credential access becomes decisive because the permissions attached to the account determine what the attacker can do after the login succeeds.
3. Impact follows when standing or over-scoped privilege lets the attacker move beyond the intended task boundary and widen the blast radius.

Breaches seen in the wild

• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
• ArtiPACKED 2024: Unit 42 found public GitHub Actions artifacts in major open source projects leaking live GITHUB_TOKENs, runtime tokens and cloud tokens.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

JIT permissions are an expiry mechanism, not a least-privilege governance model. They reduce how long access exists, but they do not determine whether the entitlement was justified, scoped correctly, or compatible with policy. The distinction is fundamental for IAM teams because fast expiry without entitlement governance only shortens the window on a bad decision.

Standing privilege is a lifecycle failure, not just a provisioning problem. Access accumulates when roles change, projects close, or machine identities are never revisited, and the entitlement survives longer than the business need. That is why access review cadences alone are insufficient if no governance layer defines what should have been present in the first place.

Least privilege becomes enforceable only when discovery, policy, and context are bound together. The article’s strongest point is that IGA supplies the entitlement model, eligibility rules, and contextual evaluation that JIT needs to act on something defensible. The practitioner implication is that access timing must be governed by entitlement truth, not by a timer alone.

Ephemeral privilege debt: a short-lived entitlement still carries full blast-radius risk if it was over-scoped at issuance. The issue is not duration alone but the fact that the access model can be wrong for the entire approved window. Teams should treat temporary access as governed exposure, not as evidence of minimal exposure.

The same entitlement problem now spans humans, NHIs, and AI agents. The article correctly places service accounts, automation workloads, and AI agents inside the same governance question as human users because each can retain access after need passes. That means IGA programmes must evaluate entitlement purpose and expiry across all actor types, not just employees.

From our research library:

• 92% of cloud identities are over-permissioned and 62% are dormant.
• Read next: Just-in-Time Access and Zero Standing Privilege Guide

What this signals

Ephemeral privilege debt: temporary access still creates lasting risk when the entitlement model behind it is weak. For identity programmes, the governance question shifts from how long access lasts to whether the permission was ever appropriate for the task, the actor, and the context.

The same pattern now spans humans, service accounts, workloads, and AI agents, which means entitlement review has to become actor-aware rather than account-aware. Once access is granted to a non-human identity without a lifecycle trigger, it can sit outside ordinary review cycles and remain operational long after the original need has ended.

That matters because excessive privilege remains common across NHIs, with 97% carrying excessive privileges according to the Ultimate Guide to NHIs. Organisations that want least privilege to hold in practice need governance that defines entitlement legitimacy before JIT starts the clock.

For practitioners

• Map all temporary access to entitlement source Trace each JIT permission back to the role, group, application right, or policy that made it eligible so that expiry is tied to a governed entitlement, not a one-off request.
• Separate session elevation from entitlement governance Use JIT access for session-level privilege and IGA for permission eligibility, because the article shows those controls solve different parts of the least-privilege problem.
• Review non-human identities for hidden standing privilege Prioritise service accounts, workloads, and AI agents that hold permissions without a lifecycle event forcing reassessment, since they are the hardest to catch in ordinary review cycles.

Key takeaways

• JIT permissions help reduce exposure, but they do not by themselves prove that access was properly authorised or appropriately scoped.
• Standing privilege remains a broad identity risk because permissions often outlive the business event that justified them.
• The control that changes the outcome is IGA, which supplies discovery, policy, contextual approval, and audit evidence for temporary access.

Key terms

• Just-in-time permissions: A control pattern that grants specific application or system entitlements only for the period they are needed, then removes them automatically. It reduces the time a permission can be abused, but it does not by itself decide whether the permission was justified or correctly scoped in the first place.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
• Least Privilege: A security principle requiring that every identity, human or non-human, is granted only the minimum permissions necessary to perform its function. Least privilege is the single most effective control for reducing NHI blast radius.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.